Design Infrastructure Solutions

A utility company is designing a serverless backend architecture to process smart meter telemetry and host a customer-facing billing API. The solution must meet the following requirements:

* Telemetry processing: Ingestion triggers a job that aggregates and stores data streams. Each execution takes up to $15$ minutes to complete.
* Billing API: Must support peak hourly traffic of $5,000$ requests, experience minimal latency during sudden scale-up (no cold starts), and require direct integration with an Azure Virtual Network (VNet).
* Operational overhead: Must be minimized.

Which two Azure hosting options should you recommend to meet these requirements? (Select TWO.)

A fintech platform is designing the networking architecture for a single-region deployment in West US 3. The design must accommodate two distinct workloads:

1. An administrative web portal that requires SSL/TLS termination and URL path-based routing (routing `/api/*` to an API service and `/reports/*` to a reporting service).
2. A high-frequency transaction ingestion service that communicates over a custom TCP protocol on port 9000 and requires extremely low latency.

To ensure resilience, all entry-point load balancers must utilize zone-redundant public IP addresses. The virtual machines hosting the transaction ingestion service currently have Basic SKU public IP addresses assigned to their network interfaces.

Which two actions should you include in the network design to meet these requirements while preventing deployment validation errors?

An enterprise is designing a high-availability infrastructure for a custom TCP-based application running on Azure Virtual Machines (VMs) in the West US 3 region. The VMs are currently configured with Basic SKU Public IP addresses. To meet SLA requirements, the load balancing solution must support Availability Zones. You plan to implement an Azure Load Balancer to distribute the incoming TCP traffic. Which of the following actions is required to design a valid load balancing configuration that supports Availability Zones?

An enterprise designs a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-eus-hub` ($10.100.0.0/16$), contains an Azure Route Server in the `RouteServerSubnet` ($10.100.1.0/24$) and a Network Virtual Appliance (NVA) at IP address $10.100.2.4$ in the subnet `snet-eus-nva` ($10.100.2.0/24$). An ExpressRoute Gateway is deployed in the `GatewaySubnet` ($10.100.0.0/24$) and connects to the corporate on-premises network ($172.16.0.0/12$). The spoke virtual network, `vnet-eus-prod` ($10.101.0.0/16$), contains a web tier subnet, `snet-prod-web` ($10.101.10.0/24$), and a database tier subnet, `snet-prod-db` ($10.101.20.0/24$). Virtual network peering is configured between `vnet-eus-hub` and `vnet-eus-prod` with "Allow gateway transit" enabled on the hub and "Use remote virtual network gateways or route server" enabled on the spoke. The Route Server is peered with the NVA. The NVA advertises a default route ($0.0.0.0/0$) via BGP to the Route Server, while the ExpressRoute Gateway propagates the on-premises route ($172.16.0.0/12$) via BGP. You must design a routing solution for the web tier subnet, `snet-prod-web`, that satisfies the following requirements:

- All internet-bound traffic must route through the NVA ($10.100.2.4$) for security inspection.
- All traffic to the on-premises network ($172.16.0.0/12$) must bypass the NVA and route directly to the ExpressRoute Gateway.
- All traffic to the database tier subnet (`snet-prod-db`) must remain local and bypass the NVA.
- All traffic to the hub management subnet, `snet-hub-mgmt` ($10.100.3.0/24$), must bypass the NVA and route directly.
- All traffic to the private endpoints subnet in the hub, `snet-hub-pe` ($10.100.50.0/24$), must route through the NVA.

Which route table configuration should you apply to `snet-prod-web` to meet these requirements with the least administrative effort?

A healthcare company is designing a container-based application on Azure to host a patient portal API. The application consists of several microservices that handle patient queries. The design must satisfy the following requirements:
- The microservices must scale down to zero instances when there is no incoming traffic to reduce costs.
- The application components must communicate privately and be isolated within an existing Azure virtual network.
- The solution must minimize administrative and infrastructure management overhead.
- Audit logs must be kept strictly isolated in their respective deployment regions to comply with data sovereignty regulations.

Which two configurations should you recommend?

An enterprise is designing a hub-and-spoke network topology in Azure to host a multi-tier application. The hub virtual network, `vnet-eus-hub` (address space: $10.100.0.0/16$), contains an Azure Firewall deployed at the internal IP address $10.100.1.4$. A peered spoke virtual network, `vnet-eus-prod` (address space: $10.101.0.0/16$), contains two subnets: `snet-web` ($10.101.10.0/24$) and `snet-db` ($10.101.20.0/24$).

The security team requires that:
1. All outbound internet traffic from `snet-web` must be inspected by the Azure Firewall.
2. All traffic between `snet-web` and `snet-db` must be inspected by the Azure Firewall.
3. Virtual machines within `snet-web` must be able to communicate directly with each other without traversing the firewall.

A network engineer creates a route table named `rt-web-routes`, defines the following user-defined routes (UDRs), and associates the route table with `snet-web`:
- Route 1: Address prefix $0.0.0.0/0$ with a next hop of Virtual Appliance ($10.100.1.4$)
- Route 2: Address prefix $10.101.0.0/16$ with a next hop of Virtual Appliance ($10.100.1.4$)

During testing, the engineer observes that virtual machines within `snet-web` are unable to communicate with each other.

Which configuration change should the engineer implement in the route table to restore intra-subnet connectivity within `snet-web` while maintaining all security requirements?

An organization is designing the routing configuration for a spoke virtual network named `vnet-spoke-prod` ($172.16.0.0/16$) in Microsoft Azure. The virtual network contains a subnet named `snet-web` ($172.16.1.0/24$).

`vnet-spoke-prod` is peered with a hub virtual network named `vnet-hub-prod` ($10.100.0.0/16$). The hub virtual network contains an Azure Firewall instance with the private IP address $10.100.1.4$.

You have the following requirements:
- All outbound traffic from `snet-web` to the internet must be routed through the Azure Firewall for security inspection.
- All traffic from `snet-web` to an external spoke virtual network named `vnet-spoke-corp` ($192.168.0.0/16$) must be routed through the Azure Firewall.
- All internal traffic within `vnet-spoke-prod` must bypass the firewall and route directly between resources using default Azure routing.

Which two routes should you add to the route table associated with `snet-web` to meet these requirements?

An enterprise is migrating a legacy, stateful transaction processing application to Azure. The application has the following requirements:
- It requires physical isolation at the hardware host level to meet compliance and licensing standards.
- The steady-state workload requires 32 vCPUs and 256 GiB of RAM, running continuously 24/7.
- The virtual machines must have a guaranteed 99.95% availability SLA.
- The database log drive requires 20,000 IOPS and sub-millisecond latency.
- The application cannot be containerized due to kernel-level licensing checks.

Which of the following compute and storage designs should you recommend to meet the requirements while minimizing costs?

An enterprise is designing a hub-and-spoke virtual network topology in Azure to secure traffic between application tiers.

The hub virtual network, `vnet-useast-hub` ($10.100.0.0/16$), hosts an Azure Firewall with the private IP address $10.100.2.4$.

The app spoke virtual network, `vnet-useast-app` ($10.101.0.0/16$), contains two subnets:
* `web-subnet` ($10.101.1.0/24$)
* `api-subnet` ($10.101.2.0/24$)

The database spoke virtual network, `vnet-useast-db` ($10.102.0.0/16$), contains one subnet:
* `db-subnet` ($10.102.1.0/24$)

Both spoke virtual networks are peered with `vnet-useast-hub`. No direct peering exists between the spokes.

You need to design a routing solution that meets the following requirements:
1. All outbound traffic from `web-subnet` to `db-subnet` must be routed through the Azure Firewall in the hub.
2. All return traffic from `db-subnet` to `web-subnet` must also traverse the Azure Firewall.
3. Traffic between `web-subnet` and `api-subnet` within the app spoke must remain local and route directly without traversing the firewall.

Which of the following configurations should you implement to meet these requirements? (Select TWO.)

A retail company is designing the network security architecture for a new containerized inventory application hosted on Azure Container Apps integrated with a virtual network named VNet1. The design must meet the following requirements:
- The application must securely retrieve secrets from an Azure Key Vault named KV1.
- KV1 must disable all public network access.
- The containerized application must resolve and connect to KV1 over a private IP address within VNet1.
- Administrative maintenance must be minimized.

Which two actions should you include in the design?

An organization plans to deploy a microservices-based application consisting of several containerized background services. The services need to scale dynamically in response to incoming messages in an Azure Service Bus queue using Kubernetes Event-driven Autoscaling (KEDA). The organization wants to avoid managing Kubernetes nodes, clusters, or control planes, and does not require direct access to the Kubernetes API. Which Azure service should you recommend to host these containerized services?

You are designing a compute solution for a new microservices application in Azure. The application must support event-driven auto-scaling and dynamic web traffic routing. You need to minimize the operational and administrative effort required to manage the container orchestration infrastructure. Which Azure service should you recommend?

A company is designing a container-based solution to process sensitive transaction workloads. The design must satisfy the following requirements:
- Host containerized applications that scale dynamically based on request load.
- Minimize container infrastructure management and administrative effort.
- Ensure that transaction audit logs are stored in compliance with strict data residency laws, requiring complete isolation of logs between different geographic regions.

Which two components should you include in the design? (Select two.)

A multinational logistics provider requires a containerized architecture to process international package shipments across two distinct geographic regions: Europe and North America. The solution must adhere to the following design constraints:

* Event-driven scaling: Individual container instances must scale dynamically from $0$ to a high volume of concurrent instances based on the message volume in an Azure Service Bus queue.
* Minimal operational complexity: The cloud architecture team has no dedicated container orchestration administrators and wants to avoid managing virtual machine nodes, orchestrator control planes, or complex deployment manifests.
* Compliance and governance: Regional package processing telemetry and event logs must remain strictly within their origin region to comply with local data sovereignty laws.

Which infrastructure design meets these requirements?

A company plans to deploy a new microservices application that consists of three containerized services. The application must support automatic scaling based on HTTP request volume, including scaling down to zero instances. The operations team has no Kubernetes experience and wants to minimize administrative overhead. Which Azure service should you recommend to host the application?

A startup is designing a containerized microservices application that will process customer orders and store logs. The application consists of three simple, stateless containers. The design must meet the following requirements:

* Minimize the administrative effort required to manage the underlying container infrastructure.
* Automatically scale the containers based on the volume of incoming HTTP requests, including scaling down to zero during idle periods.
* Segregate the telemetry and application logs from different environments (development and production) into separate workspaces to comply with data access policies.

Which combination of Azure compute hosting and log monitoring configurations should you recommend?

A startup needs to host a simple, containerized web API. The solution must support automated scaling, require zero server or cluster management overhead, and provide a secure, private registry to store the container images. Which two services should you recommend?

An enterprise is designing a compute and logging architecture for a containerized order-processing application. The design must satisfy the following requirements:
- Host multiple microservices that scale dynamically based on the queue depth of an Azure Service Bus queue using Kubernetes Event-driven Autoscaling (KEDA).
- Minimize the administrative and operational overhead associated with managing cluster infrastructure and virtual machines.
- Separate log data into different geographical regions to comply with strict regional data residency regulations.

Which compute and monitoring configuration should you recommend?

An organization is designing a compute and monitoring solution for a new microservices-based application. The application will run in containers and must meet the following requirements:
- Support dynamic, event-driven scaling based on CPU utilization and Azure Service Bus queue depth.
- Minimize the administrative and operational overhead of the container infrastructure.
- Isolate log and telemetry data for two distinct departments (Finance and HR) into separate regulatory boundaries to satisfy strict data sovereignty requirements.

Which two configurations should you recommend in the design?

An enterprise administrator needs to run a single containerized database maintenance script once per week. The container executes for approximately three minutes and then terminates. The solution must minimize deployment complexity and administrative overhead. Which Azure service should you recommend?